CVE-2025-68604
Deferred Deferred - Pending Action
Cross-Site Request Forgery in WPGraphQL

Publication date: 2026-05-07

Last updated on: 2026-05-07

Assigner: Patchstack

Description
Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows Cross Site Request Forgery. This issue affects WPGraphQL: from n/a through 2.5.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-07
Last Modified
2026-05-07
Generated
2026-06-16
AI Q&A
2026-05-07
EPSS Evaluated
2026-06-15
NVD
CVE-2025-68604
EUVD
EUVD-2025-209718
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wpgraphql wpgraphql to 2.5.3 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the WPGraphQL WordPress plugin, affecting versions 2.5.3 and earlier.

It allows an attacker to trick authenticated users into performing unwanted actions by making them click a malicious link or submit a form, exploiting their current authentication without their consent.

The vulnerability has a low severity impact with a CVSS score of 5.4 and was fixed in version 2.5.4 of the plugin.

Impact Analysis

If exploited, this vulnerability could allow attackers to force users with higher privileges to execute unwanted actions on the WordPress site while they are authenticated.

This could lead to unauthorized changes or operations being performed without the user's knowledge.

However, the risk is considered low because exploitation requires user interaction, such as clicking a malicious link.

Immediate updating to version 2.5.4 or later is recommended to mitigate this risk.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the WPGraphQL plugin to version 2.5.4 or later.

Additionally, Patchstack users can enable auto-updates for vulnerable plugins to ensure timely patching.

Compliance Impact

The provided information does not specify any direct impact of the WPGraphQL CSRF vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

There is no specific information provided about detection methods or commands to identify this Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL on your network or system.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-68604. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart